Wireless Wire Between ONT and Router Hardening

RouterOS General
1

So I have a ONT on one side of the property. And the equipment room is on the other side.

Its about 200ft in a straight shot.

Rather than run a fiber all the way around the property… we are gonna put the wireless wire on both sides

This put the units outside my firewall. As technically… its between the modem and router.

The wireless wire comes with a password on it. And I am guessing I should turn off mac telnet. And Romon has to be disabled.

What other steps should I take to make sure someone on the internet can’t reach the units?

Bonus if there is some way that I can still monitor it from in side the network.

2

Not sure what you mean. I would think its like any other MT device in between the modem and the router.
Use vlans,
a. one vlan to accept the internet traffic so as to terminate the incoming on the router
b. one vlan to manage the far end of the wireless wire.

Thus no exposure to the internet.
Assuming that the modem is just an ONT, and not accessible by you at all.

3

The ONT is “just a modem” its not accessible to users by this ISP.

Mind a mock up example?

4

Create two vlans on the router, your management vlan may or should already exist aka a trusted vlan.
As per any Router OS,
on the router you have a dedicated trunk port to the closer device aka port X,

so bridge port X, allow only vlan tagged data.
vlanYY is for incoming internet interface is port X going to close wireless wifi device.
vlanMGMT (66) is for managing all MT devices.

Ip dhcp client
interface=vlanyy

bridge vlans
add bridge=bridge tagged=bridge,portX vlan-id=YY
add bridge=bridge tagged=bridge,portX vlan-id=66 ( other tagged ports if going to other smart devices on the network or perhaps untagged to a port on the router as well ).

As far as the WW goes, never used one but I would approach as a basic ap / switch.
only need to identify vlanMGT, the rest are only data streams being transferred transparently in this case the internet traffic. SO
bridge port A (from router) trunk port vlan tagged only
bridge port WLAN tagged only
vlan bridge add bridge=bridge tagged=portA,WLAN vlanids=YY,66

++++++++++++++++++++++++++++++++++++++++++++++++
FAR END same same
only need to identify vlanMGT, the rest are only data streams being transferred transparently in this case the internet traffic. SO
bridge port B (modem) trunk port vlan tagged only
bridge port WLAN vlan tagged only
vlan bridge add bridge=bridge tagged=portB,WLAN vlanids=YY,66

That should get you the idea……….
I would look for any youtube videos for connecting this niche stuff

5

Appreciate it. Will take a closer look when I am on a computer.